Passive decoy state quantum key distribution: Closing the gap to perfect sources 
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We propose a quantum key distribution scheme which closely matches the performance of a 
perfect single photon source. It nearly attains the physical upper bound in terms of key genera- 
tion rate and maximally achievable distance. Our scheme relies on a practical setup based on a 
parametric downconversion source and present-day, non-ideal photon-number detection. Arbitrary 
experimental imperfections which lead to bit errors are included. We select decoy states by classical 
post-processing. This allows to improve the effective signal statistics and achievable distance. 

PACS numbers: 03.67.Dd, 03.67.Hk, 03.67.-a 



Quantum key distribution (QKD) allows two parties 
(Alice and Bob) to communicate securely even in the 
presence of an arbitrarily powerful eavesdropper (Eve) 
who tries to listen undetected. To prove unconditional 
security, Eve must not be restricted by any technologi- 
cal limitations, but must only be bounded by the laws 
of quantum physics. A multitude of protocols has been 
suggested in the last decades; BB84 |l| is the best-known 
and usually best-performing protocol. It was shown to 
be secure both in principle, 2\ and references therein, 
and in the presence of experimental imperfections, e.g., 
0. Unfortunately, the maximal distance and the bit 
rates over which secure communications can be guaran- 
teed are strongly constricted if experimental imperfec- 
tions are taken into account: lossy channels, imperfect 
detectors with finite efficiency, dark counts and misalign- 
ment errors, as well as non-ideal signal sources - which 
do not provide the required single photon states 0, 
- degrade the performance of the protocol. Decoy-state 
QKD, which was recently introduced by vM , analyzed in 
[21 la] and adapted for practical use in [3, |lfj , could mend 
this. Still, coherent state implementations achieve only 
about 70% of the maximal secure distance imposed by 
fundamental physics. 

In this paper, we show how we can close the gap 
between practical QKD implemented with state-of-the- 
art devices and idealized QKD assuming perfect single- 
photon signals. In our app roach, a parametric downcon- 
version (PDC) source in conjunction with a photon 
number resolving detector ^3] ~ as depicted in Fig. is 
utilized to implement a passive decoy-state QKD scheme. 
It does not require any active intensity modulation, but 
allows to improve the effectively sent signal statistics by 
employing conjugate PDC modes. Strict photon-number 
correlations between the two PDC outputs allow to infer 
the complete statistical information about one of them by 
measuring the photon number distribution of the other. 
Passive data analysis enables us to generate optimized 
effective signal statistics without physical blocking. For 
all practical purposes, our protocol accomplishes up to 
few percent the power of a single photon source in terms 
of distance, while the key generation rate is on par with 



the best available schemes. 
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FIG. 1: Setup of the proposed QKD scheme. The PDC source 
emits photon-number correlated bipartite states; the TMD 
records photon statistics. 



Since our work is based on the decoy state method, 
we begin by briefly reviewing the basic idea. The se- 
curity of BB84 relies on single photons, so signals with 
more than one photon are insecure because Eve can per- 
form a photon-number splitting (PNS) attack, which has 
been shown to be optimal For this, Eve performs 

a quantum non-demolition measurement of the photon 
number, taps one photon and delays the measurement 
until Alice and Bob announce the bases. If Eve replaces 
the lossy channel with a perfect one and passes on the 
same statistics as in the lossy channel, this attack can not 
be detected in a standard BB84 scheme. The probabil- 
ity that at least one photon of an rt-photon signal passes 
a quantum channel with transmission 77 = exp(a/10 • I) 
(where a is the loss in dB /km and I is the channel length 
in km) is given by rj n = 1 — (1 — rj) n , different loss charac- 
teristics arise for signals with different photon numbers. 
The core idea of the decoy method is to check that the 
signal losses behave as expected for different photon num- 
bers to exclude PNS attacks. For this, it is necessary to 
intersperse the signal stream with decoy states whose in- 
tensity differs slightly from the signal states, but share 
all other characteristics like wavelength and timing. A 
more detailed description can be found in the work of Lo 
and coworkers 0. 

The security analysis in proofs that a lower bound 
on the secure key generation rate is given by 



S' = q{-Q x f(E x )H 2 (E x ) 
S>S'- 0(5'). 
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In Eqn ^ the gain Q x denotes the ratio of Bob's detec- 
tion events to Alice's number of submitted signals after 
sifting; the yield Y n is defined as the probability that 
Bob receives a signal conditioned on that Alice has sent 
an n-photon signal. The parameters E x and e n describe 
the overall, and the photon number resolved quantum 
bit error rate (QBER), i.e., the fraction of signals which 
contribute false key bits although a signal was received. 
The quantities are related as follows: 

oo oo 

q x = ]Tq„ = ]T>>H, (2) 

oo 

E xQx = Y nP( n ) e n- (3) 

n=Q 

The function f(x) in Eqn. ^ accounts for non-ideal prac- 
tical error correction which does not reach the Shannon 
limit, and H2(x) is the binary Shannon entropy. The 
sifting factor q corrects incompatible bases, i.e., for stan- 
dard BB84 q = 1/2. In the asymptotic limit it is possible 
to reach values of q » 1 [a] , this is used in the remainder 
of the paper. Conventional QKD schemes employ binary 
detectors. Thus, only the overall gain Q x and QBER 
E x can be measured during transmission. Source char- 
acterization guarantees that p(n) is known. The decoy 
state idea exploits that the linear system of Equations 
© and © can be solved for Y n and e„, if states with 
different mean intensities are employed. While Y n and e n 
are identical in Eve's absence for the signal and all decoy 
states, it is proven that any PNS attack will modify these 
quantities, i.e., Eve's attempt of an PNS attack will be 
detected 0. 

The original security proof for BB84 given in [J^ uti- 
lized local operations and one-way classical communi- 
cation (1-LOCC). While many security analyses retain 
with 1-LOCC, enhanced security proofs employing 2- 
LOCC 2] have been elaborated recently and adapted to 
the decoy method in [lfij . Two-way postprocessing is 
performed by comparing parities for random bit pairs in 
Alice's and Bob's key. If the parities match, they keep 
the first bit, otherwise they discard both. One round of 
this procedure is called a B-step; repeating it for several 
rounds is possible and allows to increase the maximal se- 
cure distance. For comparison we consider both cases, 
1-LOCC and 2-LOCC. 

Consider the setup in Fig. In the source, we use 
a standard PDC process to obtain the photon-number 
correlated state 

i 00 

n— 

where A and the normalization factor Af depend on the 
physical boundary conditions The distribution ex- 
hibits Poissonian (A„ = A=, N — e~ x |2g) or thermal 



(A„ = tanh 2 ™ \, J\f — cosh 2 x) statistics in the extremal 
cases, so we will consider both possibilities. Since Eve 
has no phase reference, the phase is assumed to be totally 
randomized, and an effective mixture of photon number 
eigenstates with density operator g = J2 n \^n/N\ 2 g n is 
transmitted. 

Information encoding can be accomplished by polar- 
ization or time coding, but the exact method is of no 
relevance for the further analysis. A time multiplexed 
detector (TMD) provides photon number resolution ca- 
pabilities. There are several methods to perform photon 
number resolution, but we focus on TMD detection ^1 
since it is cost-effective and easy to handle experimen- 
tally. The measured TMD statistics can be related to 
the impinging photon number statistics by 

Psourcc — L • C • Pmcas = ^-(Pmcas) (5) 

where the loss matrix L accounts for photon loss in the 
detection, and the convolution matrix C models the effect 
of a finite number of detected modes in the TMD design 
(for details: see 0); p s and p m describe the original 
photon number distribution of the source and the mea- 
sured statistics. The quantity C • L can be determined 
by measurement, but there is also an analytical repre- 
sentation p^(m|n.) for the matrix entries given in |l7j |. It 
represents the probability to get an m-photon detection 
outcome conditioned on n photons entering the detector 
with total loss rj. Using Eqn. [SJ the TMD measurement 
can be inverted so that the real statistics of the source are 
reconstructed with high fidelity 0]. Note that this inver- 
sion is only possible for an ensemble of states, but not for 
a single signal, so Alice needs to record the measurement 
results of the TMD for every time slot. After this, Al- 
ice and Bob follow the standard protocol of BB84 [4j for 
information encoding and analysis. 

The essential step of passive decoy state selection fol- 
lows after a sufficiently large number of signals (say, 
^Vtot S> 1) has been transmitted; note that Alice will run 
the source with constant pump intensity and without any 
active optical manipulations for the duration of the pro- 
cedure. Fig. |21 provides an overview about the process: 
The measured discrete probability distribution p mcas is 
calculated by p m cas(«) = , where #n to t denotes 

the number of n-photon measurement outcomes from the 
TMD. This distribution can be inverted by Eqn. 03 the 
strict photon number correlations of the PDC states en- 
sure that Alice's measurement coincide with the signal 
statistics. 

Assume that we start with a random selection of a set 
containing M <c N to t signals to construct decoy states, 
which have exactly the same statistics as the remaining 
signal states. Alice then additionally picks 5 n slots with 
an n-photon measurement result such that 

M 

#"decoy = #rHot ' T7 1" $ n (6) 

-IVtot 
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FIG. 2: (Color online) Classical decoy state selection. Apt 
subsets of the recorded TMD measurements are selected and 
inverted to form the decoy states which are similar to the 
signal state. The photon number distributions are not drawn 
to scale for instructive purposes. 



where S n is a small positive or negative offset which re- 
sults in a photon number distribution of the decoy subset 
differing slightly from the distribution in the signal. The 
decoy subset can be inverted to obtain the proper proba- 
bility distribution pdecoy Depending on how many decoy 
states are to be used (one vacuum state and two decoy 
states similar to the signal are sufficient, cf. an 
appropriate number of subsets has to be chosen. Differ- 
ent distributions of S n for different subsets ensure that 
the generated decoy signals are sufficiently distinct from 
each other as required to solve the system of linear equa- 
tions We would like to stress that our passive 
method for "generating" decoys provides distinct advan- 
tages: during signal transmission it is still undecided 
which states will become signal or decoy states. This im- 
plies that a distinction between signal and decoy states 
by Eve is not possible, even in principle. It is also impor- 
tant to emphasize that our decoy selection mechanism 
eliminates many experimental challenges (e.g., different 
spectra of the generated PDC light for signal and decoys 
which gives Eve a chance to experimentally distinguish 
between them) which arise in proposals with the same 
hardware, but a different analysis procedure ( [20I l2l|). 
which do not draw maximal use of the TMD's capabil- 
ities. The remainder of the protocol is identical to a 
standard decoy scheme: Alice and Bob check e„ and Y n 
as described above. Error correction and privacy ampli- 
fication need to be performed to generate a final secure 
key. The inset in Fig. [3] presents our simulation results 
(for details see below) . The key generation rate and max- 
imal secure distance closely match a perfect single photon 
source. 

The TMD results can not only be used to generate 
decoy states, but also provide improved effective sig- 
nal statistics. While the error rates e„ for n > 1 are 
the order of 10 -2 , the contribution by vacuum signals is 
eo = 1/2 [2]]]. Thus, it is desirable to remove such events 
as good as possible. Decreasing the dark count rate on 
Bob's side is hard because it requires refinement of the 
detectors, while fine-grained time triggering can be used 
on Alice's side to reduce the dark count probability in the 
TMD to a negligible level, i.e., p(n\m) = for n > m [l2|| . 



Note that due to losses and imperfect detection, filtering 
multi-photon contributions does not work perfectly and 
results in comparatively small rate improvements ( 20]). 
The benefits are negligible in contrast to filtering zero 
photon contributions. Alice has recorded the TMD mea- 
surement for every signal. Hence she can easily discard 
all zero events in the postprocessing phase which leads 
to a better effective probability distribution given by 

[O n = 

P/,mcasW = < 1 #n „ > n > (?) 

where p / jmea s denotes the measured, filtered distribution; 
the effectively sent distribution is p = 7£(p/ imC as)- Since 
p(0\n) ^ for n > 0, some usable signal states are also 
removed from the distribution, but this does not endan- 
ger the total positive effect of the filtering. To implement 
the operation, Alice and Bob need to discard all slots in 
the postprocessing stage where the TMD result was zero 
and use the inverted probability distribution in the rate 
calculations. 



2-LOCC, Optimized number of B-Steps. Inset: 1-LOCC. Maximal distance 208 km 
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FIG. 3: (Color online) Simulation results for two-way and 
one-way (inset) classical communication. Both graphs were 
obtained by a numerical evaluation of Eqn. Q the optimal 
values for \ and the number of B-Steps which maximize the 
key generation rate have been used for all distances. The 
right border represents the principal upper bound given by 
the intercept-resend attack. 

Note that filtering of this type does not reduce the sig- 
nal rate: A subset of the signal set is removed during 
postprocessing because this subset will make the over- 
all result only worse. No physical blocking of signals is 
performed. This leaves the transmitted signals unmod- 
ified. Fig. |2l and Tab. U present the results of the nu- 
merical evaluation for all cases discussed above: Signals 
with and without filtering for both 1- and 2-LOCC. Note 
that we apply an optimization for both, the best value 
for x and the ideal number of B-Steps for every distance. 
To allow comparison with other proposals, we use the 
set of experimental parameters given in [22^ . The upper 
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bound on the secure distance caused by the undetectable 
intercept-resend attack at a QBER of more than 25% |5| 
lies at 208km, i.e., the right border of the graph. The 
lower bound on our rate closely approaches this upper 
limit, and reaches the single photon performance. One 
also needs to keep in mind that this upper bound is not 
even tight, but can be replaced by smaller ones (e.g., 

The filtering transformation in Eqn. modifies the 
effective signal distribution so that a different rate is 
obtained although the sent statistics remain unmodi- 
fied. Thus, a penalty factor needs to be introduced into 
Eqn. ^ when an optimal \ is sought to maximize S: 

S > Ppon • S' ■ Q(S'), Ppon = 1 - J2n=oP(®\ n )Ps( n )- Tne 

optimal values for x depend on the simulation parameters 
and the source statistics; a comprehensive set of results 
for different combinations can be found in [24|. Here it 
suffices to know that the range for x 1S (0, 0.5) which 
can well be realized with current PDC sources |25j. Ex- 
isting sources provide better performance than actually 
required. 



Source 



distance 
unf./filt. 



Thermal (1-way) 
Thermal (2-way) 



130.8/169.7 
174.5/194.5 



0.7% 18.3% 
0.4% 6.3% 



Poissonian (1-way) 141.2/166.0 2.9% 20.0% 
Poissonian (2-way) 180.8/193.8 0.7% 6.6% 

TABLE I: Comparison of the obtainable distances for differ- 
ent signal sources and postprocessing methods with the limits 
set by a perfect single photon source and the principal phys- 
ical upper bound. A perfect single photon source achieves 
170.9km for 1-LOCC and 195.2km for 2-LOCC. A 1>f denotes 
the difference to this distance. A2,f denotes the the difference 
to the principal intercept-resend upper bound. Both refer to 
the effectively filtered source. At most 4 B-Steps were used. 

As explained above, two-way processing with B-steps 
can increase the achievable distances. Ma et al. ^| cal- 
culated that after performing a B-Step, a lower bound 
on the secure key generation rate is given by S' = 
qQ x {\s n ^{-f{E' x )H 2 {E' x ) + n'{l-H 2 {e'^)))), S > 
S' ■ O(S') . A detailled derivation of the formula is beyond 
the scope of this paper, but can be found in Refs. |l5j,|24j. 
Multiple rounds of B-Steps apply the transformation 
multiple times) . The difference between the lower bound 
on the maximal secure distance and the principal limit 
shrinks to about 6.5% with 4 B-Steps as shown in Tab. [I] 

In summary, we have shown how to use the photon 
number correlations of a PDC source to implement a 
BB84 scheme which nearly reaches the performance of a 
single photon scheme. This removes the predominant im- 
perfection from real-world QKD implementations. Since 
the lower bound on the key generation rate coincides up 
to a few percent with the principal upper bounds, fur- 



ther improvements need either come from new protocols 
or improved hardware. Refinements of security proofs 
will likely be unfruitful by comparison. 

We acknowledge helpful comments by N. Liitkenhaus, 
H.-K. Lo and J. Lundeen. 
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y is a coupling strength and interaction time parameter; 

the mean photon number is given by sinh 2 \ UJ • 

If a vacuum pulse is sent and a dark count causes one 

detector to click, it is the wrong one with 50% chance. 



